hive-subagent-mcp: test that start and continue apply the swarm model list

`Reader` gets a test-only fixed source that counts its reads, and `State`
takes the agent's own list as a `fn` (`available_models` outside tests), so
`start` and `continue_` can be driven through `State::allow_model` without
a queue or a process-wide env change. The new tests pin that both calls
refuse a model outside the swarm list ahead of `reserve`, accept a model
the swarm lists but the local list lacks, and read nothing for a call
without a `model`.

Refs #5034 (S5)

hive-subagent-mcp/src/session.rs

@@ -389,6 +389,9 @@ pub struct State {
     /// Where the swarm's `subagent_models` for this agent is read from, when
     /// this agent can read it ([`State::reading_models_from`]).
     models: Option<crate::swarm_models::Reader>,
+    /// The agent's own model list, checked when the swarm sets none:
+    /// [`available_models`] outside tests.
+    local_models: fn() -> Option<String>,
 }
 
 /// Which opaque URL segment belongs to which session — the whole of a
@@ -443,6 +446,7 @@ impl State {
             runtime: SubagentRuntime::Claude,
             term: None,
             models: None,
+            local_models: available_models,
         }
     }
 
@@ -471,7 +475,7 @@ impl State {
             Some(reader) => Some(reader.read().await),
             None => None,
         };
-        check_model(model, &model_list(read, available_models()))
+        check_model(model, &model_list(read, (self.local_models)()))
     }
 
     /// Run every subagent on `runtime` — the daemon passes the parent
@@ -4324,6 +4328,82 @@ mod tests {
         );
     }
 
+    /// A state whose swarm read answers `read` and whose own list is `haiku`,
+    /// with `name` already reserved: a call that gets past the model check
+    /// stops at `reserve` and spawns nothing. Also the reader's read count.
+    fn state_reading(
+        read: crate::swarm_models::Read,
+        name: &str,
+    ) -> (Arc<State>, Arc<std::sync::atomic::AtomicUsize>) {
+        let (reader, reads) = crate::swarm_models::Reader::fixed(read);
+        let mut state =
+            State::new(PathBuf::from("/dev/null"), signal_url()).reading_models_from(Some(reader));
+        state.local_models = || Some("haiku".to_owned());
+        assert!(state.reserve(name));
+        (Arc::new(state), reads)
+    }
+
+    fn start_on(name: &str, model: Option<&str>) -> StartRequest {
+        StartRequest {
+            model: model.map(str::to_owned),
+            ..start_request(name)
+        }
+    }
+
+    async fn continue_on(
+        state: &Arc<State>,
+        name: &str,
+        model: Option<&str>,
+    ) -> anyhow::Result<String> {
+        continue_(
+            state,
+            name,
+            "go".to_owned(),
+            model.map(str::to_owned),
+            None,
+            None,
+        )
+        .await
+    }
+
+    /// The refusal comes from the model check, ahead of `reserve`'s.
+    #[tokio::test]
+    async fn start_and_continue_refuse_a_model_outside_the_swarm_list_before_reserving() {
+        let (state, reads) = state_reading(swarm(&["sonnet"]), "n");
+        let started = start(&state, start_on("n", Some("opus"))).await;
+        let continued = continue_on(&state, "n", Some("opus")).await;
+        for result in [started, continued] {
+            let err = result
+                .expect_err("opus is outside the swarm's list")
+                .to_string();
+            assert!(err.contains("swarm's subagent_models"), "{err}");
+        }
+        assert_eq!(reads.load(std::sync::atomic::Ordering::Relaxed), 2);
+    }
+
+    #[tokio::test]
+    async fn start_and_continue_take_a_swarm_listed_model_the_local_list_lacks() {
+        let (state, _) = state_reading(swarm(&["opus"]), "n");
+        let started = start(&state, start_on("n", Some("opus"))).await;
+        let continued = continue_on(&state, "n", Some("opus")).await;
+        for result in [started, continued] {
+            let err = result.expect_err("the name is reserved").to_string();
+            assert!(err.contains("already running"), "{err}");
+        }
+    }
+
+    #[tokio::test]
+    async fn start_and_continue_without_a_model_do_not_read_the_swarm() {
+        let (state, reads) = state_reading(swarm(&["sonnet"]), "n");
+        let started = start(&state, start_on("n", None)).await;
+        let continued = continue_on(&state, "n", None).await;
+        for result in [started, continued] {
+            let err = result.expect_err("the name is reserved").to_string();
+            assert!(err.contains("already running"), "{err}");
+        }
+        assert_eq!(reads.load(std::sync::atomic::Ordering::Relaxed), 0);
+    }
+
     /// A `tracing` writer whose output a test can read back.
     #[derive(Clone, Default)]
     struct CapturedLogs(Arc<Mutex<Vec<u8>>>);